chromium/content/browser/web_contents/web_contents_view_drag_security_info.cc

// Copyright 2023 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "content/browser/web_contents/web_contents_view_drag_security_info.h"

#include "content/browser/renderer_host/render_widget_host_impl.h"
#include "content/browser/site_instance_group.h"
#include "content/public/common/drop_data.h"

namespace content {

WebContentsViewDragSecurityInfo::WebContentsViewDragSecurityInfo() = default;
WebContentsViewDragSecurityInfo::~WebContentsViewDragSecurityInfo() = default;

void WebContentsViewDragSecurityInfo::OnDragInitiated(
    RenderWidgetHostImpl* source_rwh,
    const DropData& drop_data) { … }

void WebContentsViewDragSecurityInfo::OnDragEnded() { … }

bool WebContentsViewDragSecurityInfo::IsImageAccessibleFromFrame() const { … }

// The browser-side check for https://crbug.com/59081 to block drags between
// cross-origin frames within the same page. Otherwise, a malicious attacker
// could abuse drag interactions to leak information across origins without
// explicit user intent.
bool WebContentsViewDragSecurityInfo::IsValidDragTarget(
    RenderWidgetHostImpl* target_rwh) const { … }

}  // namespace content